Simms & Associates EMEA SLU informs users about the processing of personal data collected through its website: https://simms-associates.com/

This Privacy Notice explains what personal data we collect, why we process it, the legal basis for processing, how long we retain it, with whom it may be shared, and the rights users may exercise under applicable data protection law.

1. Data controller

The data controller responsible for the processing of personal data collected through this website is:

• Company name: Simms & Associates EMEA SLU
• Tax number: ESB87473096
• Address: Calle de José Benlliure 273, 46011, Valencia, Spain
• Website: https://simms-associates.com/
• Privacy contact email: privacy@simms-associates.com

Users may contact S&A regarding any privacy or data protection matter by emailing: privacy@simms-associates.com.

2. Personal data processed

S&A may process personal data provided by users through the website, including through contact forms, email communications, cookie preferences or other website interactions.

The categories of personal data processed may include, where applicable:

• Identification data, such as name and surname.
• Contact details, such as email address, telephone number, company name or postal address.
• Professional information, such as role, organisation or business details.
• Information included by the user in messages, forms, requests or communications.
• Technical and browsing data, subject to the user’s cookie preferences, such as analytics identifiers, device information or website usage data.
• Any other information voluntarily provided by the user through the website.

Users must ensure that the personal data they provide is accurate, complete and up to date. Users are responsible for notifying S&A of any changes to the information provided.

3. Purposes of processing

S&A may process personal data collected through the website for the following purposes:

• Responding to information requests submitted through the website or by email.
• Managing communications with users, potential clients, clients, suppliers or business contacts.
• Maintaining commercial or professional relationships.
• Providing services tailored to clients’ specific needs in accordance with the contracts entered into.
• Managing requests for information, training, consultancy or other activities related to S&A.
• Sending commercial information, newsletters or promotional communications where legally permitted or where the user has given consent.
• Managing the company’s commercial, corporate, administrative and accounting obligations.
• Archiving, updating, protecting and safeguarding company information and databases.
• Maintaining website security, technical functionality and service quality.
• Measuring and analysing website usage, subject to the user’s cookie consent where required.
• Managing CRM, chat or marketing tools, subject to the applicable legal basis and cookie consent where required.

4. Legal basis for processing

The processing of personal data may be based on one or more of the following legal grounds:

• Performance of a contract or pre-contractual measures
  Where processing is necessary to respond to requests, provide information, prepare proposals, manage services or perform a contract with the user or the organisation they represent.
• User consent
  Where the user has given free, specific, informed and unequivocal consent, for example by ticking a checkbox, submitting a form or accepting optional cookies through the cookie banner.
• Legitimate interests of S&A
  Where processing is necessary for legitimate business purposes, such as maintaining professional relationships, responding to communications, improving services, ensuring website security or managing ordinary business operations, provided that such interests are not overridden by the rights and freedoms of the user.
• Compliance with legal obligations
  Where processing is necessary to comply with applicable legal, tax, accounting, labour, corporate, administrative or regulatory obligations.

Users may withdraw consent at any time where processing is based on consent. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

5. Mandatory information

Certain fields in website forms may be marked as mandatory.
If the user does not provide the required information, S&A may be unable to:

• Respond to the user’s request.
• Provide the requested information.
• Manage the relevant communication.
• Perform or prepare a service contract.
• Send requested communications or materials.

6. Retention period

S&A will retain personal data for as long as necessary to fulfil the purposes for which it was collected.

In particular:

• Data related to information requests will be retained for the time necessary to respond to and manage the request.
• Data related to commercial or contractual relationships will be retained for as long as the relationship remains in force.
• Data used for commercial communications will be retained until the user withdraws consent or objects to receiving such communications.
• Data processed on the basis of legal obligations may be retained for the periods required by applicable law.
• Data may also be retained for the time necessary to address possible legal liabilities arising from the services provided or from the processing activity.

Once the applicable retention period has expired, personal data will be deleted, blocked or anonymised, as appropriate.

7. Recipients and processors of personal data

S&A will not sell personal data to third parties. Personal data may be disclosed to public authorities, courts, regulators or other third parties where required by applicable law.

In addition, S&A may use third-party service providers that process personal data on behalf of S&A where necessary for the operation of the website, the provision of services, communications with users, analytics, customer relationship management, hosting, security, maintenance or administrative purposes.

These providers may include, where applicable:

• Website hosting and infrastructure providers.
• Email, communications and productivity service providers.
• Analytics providers, such as Google Analytics, subject to the user’s cookie consent where required.
• CRM, marketing automation or chat providers, such as HubSpot, subject to the user’s cookie consent where required.
• IT maintenance, security and technical support providers.
• Professional advisers, including legal, accounting, tax or compliance advisers.
• Public authorities, courts or regulators where disclosure is required by law.

Where third-party providers act as processors, they will process personal data under the corresponding data processing agreement and in accordance with S&A’s instructions.

8. International transfers

Some of the service providers used by S&A may process personal data outside the European Economic Area, including in the United States.

Where international transfers of personal data take place, S&A will ensure that such transfers are carried out
in accordance with applicable data protection laws and are covered by appropriate safeguards, such as:

• An adequacy decision adopted by the European Commission, where applicable.
• The EU-U.S. Data Privacy Framework, where the provider is certified under that framework.
• Standard contractual clauses approved by the European Commission.
• Any other valid transfer mechanism permitted under applicable data protection law.

Further information on the applicable safeguards may be requested by contacting S&A at: privacy@simms-associates.com.

9. User rights

Users may exercise the following rights under applicable data protection law:

• Right of access
  To obtain confirmation as to whether S&A processes their personal data and to access such data.
• Right to rectification
  To request correction of inaccurate or incomplete personal data.
• Right to erasure
  To request deletion of personal data where legally applicable.
• Right to object
  To object to the processing of personal data in certain circumstances.
• Right to restriction of processing
  To request restriction of processing where legally applicable.
• Right to data portability
  To receive personal data in a structured, commonly used and machine-readable format, where legally applicable.
• Right to withdraw consent
  To withdraw consent at any time where processing is based on consent.
• Right not to be subject to solely automated decisions
  To avoid being subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significantly affect the user.

Users may exercise these rights by contacting S&A at privacy@simms-associates.com or by sending a written request to Calle de José Benlliure 273, 46011, Valencia, Spain. S&A may request additional information where necessary to verify the user’s identity before processing the request.

10. Right to lodge a complaint with the supervisory authority

If a user believes that the processing of their personal data does not comply with applicable data protection regulations, or if they consider that their data protection rights have not been properly addressed, they have the right to lodge a complaint with the competent supervisory authority.

In Spain, the competent supervisory authority is the Agencia Española de Protección de Datos, known as the AEPD. More information is available at: https://www.aepd.es

11. Automated decision-making and profiling

S&A does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning users or similarly significantly affect them.

Where analytics, CRM, chat or marketing tools are used, they will be used in accordance with the applicable legal basis and, where required, subject to the user’s prior consent.

12. Commercial communications

In compliance with applicable law, including the LSSI, S&A will not send unsolicited advertising or promotional communications by email or other equivalent electronic means unless legally permitted or expressly authorised by the recipient.

Where there is an existing contractual relationship, S&A may send commercial communications regarding products or services similar to those initially contracted, where permitted by law.

Users may object to receiving commercial communications or unsubscribe at any time by contacting privacy@simms-associates.com or by using any unsubscribe mechanism included in the relevant communication, where available.

13. Cookies and analytics

The website may use cookies and similar technologies, including analytics, functional/chat and marketing or social media cookies.

Non-essential cookies will only be used where the user has given prior consent through the cookie banner or Cookie Settings panel. For more information, please see the Cookies Policy: https://www.simms-associates.com/cookie-policy/

14. Information provided by users

Where users submit information through forms, email or other communication channels made available by S&A, users are responsible for ensuring that the information provided is accurate, lawful and does not infringe the rights of third parties. Users must not provide personal data of third parties unless they are authorised to do so and have complied with any applicable information or consent requirements.

15. Security measures

S&A adopts appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures are designed to ensure an appropriate level of security, taking into account the nature of the data, the risks associated with processing, the state of the art, implementation costs and the scope, context and purposes of processing.

16. Updates to this Privacy Notice

S&A may update this Privacy Notice when necessary due to:

• Changes in the processing of personal data.
• Changes in the services provided.
• Changes in legal or regulatory requirements.
• Changes in the criteria issued by competent supervisory authorities.
• Changes in website functionality or third-party providers.

Users are encouraged to review this Privacy Notice periodically.